
FIG. 1 



I/O Data 
Port(s) 
235 



Display 




Processor 




Memory 


210 


M 


220 


>■ 


215 



Input 
Device(s) 
205 



Speaker 
230 



Storage 
System 
225 



Data Processing 
System 
200 



FIG, 2 



Memory 
305 



Operating System 
315 



Processor 
300 



310 



Blocking Measure 
Processing 
320 



FIG. 3 



Begin 



Detect anomaly in 
communication traffic 



400 



Apply first blocking 
measure that stops 
anomalous traffic 



405 



Determine second 
blocking measure such 
that a logical combination 

of the first blocking 
measure and the second 
blocking measure stops 
the anomalous traffic 




FIG. 4 



Blocking measure A 



505 



500 



Impose Blocking 
measure A & B 



1 



510 



Impose Blocking 
measure A & !B 



Remove A & B 



Anomaly reoccur? 



Yes 



Reimpose A & B 



Remove A & !B 



535 



540 



545 



Anomaly reoccur? 



Yes 



Reimpose A 



560 



515 



520 



No 

A. 



Cancel A & B 



Enforce A & !B 



No 





r 


Cancel A & !B 




f 


Enforce A & B 



525 



530 



550 



555 



FIG. 5 



